ESBD_450511_1756484261407_05_Form 04 SPI Form.pdf

TWC Security and Privacy Inquiry (SPI) Form Revised May 2024

Security and Privacy Inquiry (SPI) Form

Note: This form is required for vendors with access to TWC confidential information. Defined terms in this document can be found in the DUA.

Business Information

Legal Name:

Address:

Tax ID Number (last four):

TWC Contract Number:

Phone Number:

Email Address:

Security Official

Name:

Privacy Official

Name:

Number of vendor employees to handle TWC Confidential Information:

Number of vendor subcontractors to handle TWC Confidential Information:

Does vendor have written privacy and security policies applicable to TWC confidential information?

If yes, please provide.

Policy subject matter is not limited to, but would include:

Policy banning prohibited technology https://dir.texas.gov/information-security/prohibited-technologies

Access Control

Awareness and Training

Audit and Accountability

Assessment, Authorization, and Monitoring

Configuration Management

Contingency Planning

Identification and Authentication

Incident Response

Maintenance

Media Protection

Physical and Environmental Protection

Planning

Program Management

Personnel Security

PII Processing and Transparency https://dir.texas.gov/information-security/prohibited-technologies

Risk Assessment

System and Services Acquisition

System and Communications Protection

System and Information Integrity

Supply Chain Risk Management

Other(s). Please describe:

Provide authorization boundary diagram (ABD) of service provided to TWC. Diagram should include different boundaries between service provider and TWC, different zones (external, DMZ, and internal), and depict interconnected systems that provide services to TWC.

1. Provide data flow diagram of service provided to TWC. Diagram should include how different accounts access data provided by service, the types of data flowing through the service, and how the data types are protected in process, transmission, and storage for production, test, development, and alternate sites.

2. Does vendor have any impediments to providing mandatory privacy and security training to employees and subcontractors? If yes, please describe.

3. Will access to TWC Confidential Information be transient or persistent?

Privacy Questionnaire:

Does Vendor incorporate the following into its privacy practices? Please explain.

Transparency: Notify individuals about the information collected, how it will be used, how it will be disseminated, and how it will be maintained, including how long it will be retained.

Individual Participation: Involve individuals in the process of using PII and, to the extent practicable, seek individual consent for the collection, use, dissemination, and maintenance of PII.

Purpose Specification: Articulate the authority that permits the collection of PII and specifically articulate the purpose(s) for which the PII is intended to be used.

Data Minimization: Collect PII that is directly relevant and necessary to accomplish the specified purpose(s) and only retain PII for as long as is necessary to fulfill the specified purpose(s).

Use Limitation: Use PII solely for the purpose(s) specified.

Data Quality and Integrity: Ensure that PII is accurate, relevant, timely, and complete.

Accountability and Auditing: Be accountable for complying with these principles and audit the actual use of PII to demonstrate compliance.

Security Questionnaire

Will TWC data be processed, transmitted, or stored outside of the US (includes the 50 states and District of Columbia)?

Yes

No

If so, please explain what data is processed, transmitted, or stored and the justification?

1. Is the data encrypted with the key held exclusively in the United States?

2. Does the vendor process, transmit, or store related functions, such as support, develop, test, backup, etc. Outside of the US? If so, please explain.

3. Does vendor (business) own all hardware that will access, store, or otherwise use TWC Confidential Information?

4. Does vendor have procedures to terminate access to TWC’s Confidential Information when employees and subcontractors are terminated or no longer have a business need to access TWC’s Confidential Information?

5. Does vendor have procedures to sanitize TWC data when contract is terminated?

6. Does vendor have procedures to sanitize TWC data when subcontractors are terminated?

7. Does each individual who will access TWC’s Confidential Information have a unique user ID and password?

8. Does vendor have password policies that require complex passwords and regular changes to passwords?

9. If cloud service, what is the FedRAMP and/or TX-RAMP status?

10. If Platform as a Service (PaaS) is leveraged for underlying service, what is the PaaS FedRAMP and/or TX-RAMP status?

11. If Infrastructure as a Service (IaaS) is leveraged for underlying service, what is the IaaS FedRAMP and/or TX-RAMP status?

Data at Rest:

Storage Devices – Which devices may be used to transmit, receive, use, and/or store TWC Confidential Information?

Cloud Services

Data Center

Devices PC, Tablet, Mobile Device

Servers

Provide the count of devices or services:

Data Classification

Data in Use:

Access control to data limited to user role

User Training

Data in Motion:

Encrypt data using VPN tunnel HTTPS or SSL/TLS

Is PII Information protected through appropriate security safeguards?

Explain.

Accessibility Report

Filename:

TWC DUA Attachment 1 SPI Form.pdf

Report created by:

Organization:

[Enter personal and organization information through the Preferences > Identity dialog.]

Summary

The checker found no problems in this document.

Needs manual check: 2

Passed manually: 0

Failed manually: 0

Skipped: 0

Passed: 30

Failed: 0

Detailed Report

Document

Rule Name Status Description

Accessibility permission flag Passed Accessibility permission flag must be set

Image-only PDF Passed Document is not image-only PDF

Tagged PDF Passed Document is tagged PDF

Logical Reading Order Needs manual check Document structure provides a logical reading order

Primary language Passed Text language is specified

Title Passed Document title is showing in title bar

Bookmarks Passed Bookmarks are present in large documents

Color contrast Needs manual check Document has appropriate color contrast

Page Content

Rule Name Status Description

Tagged content Passed All page content is tagged

Tagged annotations Passed All annotations are tagged

Tab order Passed Tab order is consistent with structure order

Character encoding Passed Reliable character encoding is provided

Tagged multimedia Passed All multimedia objects are tagged

Screen flicker Passed Page will not cause screen flicker

Scripts Passed No inaccessible scripts

Timed responses Passed Page does not require timed responses

Navigation links Passed Navigation links are not repetitive

Forms

Rule Name Status Description

Tagged form fields Passed All form fields are tagged

Field descriptions Passed All form fields have description

Alternate Text

Rule Name Status Description

Figures alternate text Passed Figures require alternate text

Nested alternate text Passed Alternate text that will never be read

Associated with content Passed Alternate text must be associated with some content

Hides annotation Passed Alternate text should not hide annotation

Other elements alternate text Passed Other elements that require alternate text

Tables

Rule Name Status Description

Rows Passed TR must be a child of Table, THead, TBody, or TFoot

TH and TD Passed TH and TD must be children of TR

Headers Passed Tables should have headers

Regularity Passed Tables must contain the same number of columns in each row and rows in each column

Summary Passed Tables must have a summary

Lists

Rule Name Status Description

List items Passed LI must be a child of L

Lbl and LBody Passed Lbl and LBody must be children of LI

Headings

Rule Name Status Description

Appropriate nesting Passed Appropriate nesting

Back to Top